CCPA and CPRA explained for website owners

California's privacy regime — the CCPA, expanded by the CPRA — takes a different approach from the GDPR. Instead of requiring opt-in consent before tracking, it gives consumers the right to opt out of the sale or sharing of their personal information.

Opt-out, not opt-in

Under the CCPA you generally don't need consent before setting cookies. Instead, you must offer a clear way for users to opt out. This is why California-focused banners often show a Do Not Sell or Share My Personal Information link rather than an Accept/Reject prompt.

Who it applies to

The law targets for-profit businesses that meet thresholds such as significant revenue or processing the data of large numbers of California residents. Even sites based elsewhere can fall in scope if they reach Californian users.

Global Privacy Control

California recognizes the Global Privacy Control (GPC) — a browser signal that automatically communicates an opt-out. Compliant sites must detect and honor it, not just rely on a manual link.

Practical setup

1. Detect the visitor's region and choose the right notice.
2. For California, surface the opt-out link and honor GPC.
3. Record the opt-out so downstream tools stop sharing data.
4. Keep your privacy policy aligned with what the banner says.